6551 Account for POLYROBs home
Mint not live yet. Mint opens later. For mint news, join the community: t.me/thepublicden.

ERC-6551P

An NFT that owns a wallet, safe to sell. No lock.

ERC-6551P is our proposed extension of ERC-6551. Every 6551 Account for POLYROBs uses it.

Status. ERC-6551P is a draft. It is not an accepted standard: only the EIP editors give an ERC number. This mint is its first, experimental deployment. The code is built and tested by us. An outside audit is planned; until then, no outside firm has audited it.

The problem

ERC-6551 gives an NFT a wallet. It leaves the sale out. Its own text says: "Preventing fraud is outside the scope of this proposal."

A buyer of the NFT buys the wallet. The seller can hurt the buyer in two ways:

  • Rights that stay after the sale. Before the sale, the wallet lets another address of the seller move its tokens. The NFT changes hands. That right does not. Later, the seller takes the tokens from the buyer's wallet.
  • The last-second drain. The buyer sees "the wallet holds 1 ETH" and buys. Just before the purchase goes through, the seller moves the 1 ETH out. The buyer gets an empty wallet.

The author of ERC-6551 names this as the reason it is not final yet: how to stop "bait-and-switch scams" is still open.

Why not a lock

The common answer is a lock: the owner freezes the wallet while the NFT is for sale.

  • A frozen wallet cannot act. An agent that lives in it stops.
  • A lock does not stop a token approval. The approved address can still move the tokens.
  • An owner can lock a wallet for a long time and then sell it frozen.

The ERC-6551 author wrote that an early lock was removed for these reasons. ERC-6551P has no lock.

Two promises

1. Nothing survives the sale. After the NFT changes hands, the seller keeps no right over what the wallet holds, on the surfaces the wallet checks. This holds on every sale path, on any marketplace.

2. You get what you checked. The buyer writes a list: "at least 1 ETH, this token, the pool position". The list is checked on the wallet after the NFT moves, in the same transaction. If one line fails, the whole sale is undone. This holds only on the checked paths: our market, our Seaport zone, and our checked fill of any Seaport listing. A plain marketplace fill checks nothing for the buyer.

How it works

The picture

The NFT is the deed of a house. The wallet is a safe inside the house. With a normal ERC-6551 wallet, the seller can copy the key of the safe, or empty it on the morning of the sale. With ERC-6551P:

  • No spare keys. Any key the owner gives out comes back before the owner walks away.
  • The key changes with the deed. The moment the deed moves, only the new owner opens the safe.
  • A check at the closing. On a checked sale, the buyer's list is checked after the deed moves.

What people do

  • Sell on our market, or with our zone on Seaport. The agent keeps working while the NFT is listed. The buyer's list is checked at the sale.
  • Mark it ready, then list it anywhere. Any action with the wallet ends "ready". A plain fill checks nothing for the buyer.
  • Buy through a checked path. The site reads the wallet and writes the buyer's list.

The parts

  • The wallet acts only for the NFT's owner, and lets no right outlive an action.
  • The NFT contract decides who may move the NFT, and when.
  • The market and the zone check the buyer's list at the sale.

The checks

  • The owner, again after every step. One action can have many steps. After each step, the wallet asks who owns the NFT now. If the owner changed, the whole action is undone.
  • Every approval is read back. When a step gives an approval, the wallet reads it again at the end of the action. If it is higher than before, the whole action is undone.
  • Things the wallet never does. No NFT approval. No NFT operator (one exception: a plain ERC-1155 operator, reset in the same action). No signatures of any kind. No marketplace orders, pre-signed orders or delegations.
  • A counter on every action. The wallet's state changes with every action, so a sale can see that something happened.
  • The sale rule in the NFT. When anyone other than the owner moves the NFT, the move needs: the wallet not in the middle of an action; a seller that is not another NFT's wallet; and either "ready" from an earlier transaction with nothing done since, or a one-use pass from our market or zone.

The wallet keeps some gas for its checks after each step. An action needs more gas than it uses. Wallet apps that estimate gas handle this.

What it does not cover

  • Rights made through a call the wallet cannot read, or through a contract that lies.
  • Bugs. An outside audit is still required.
  • A plain marketplace fill, or a plain offer the seller fills: no check for the buyer.
  • Rights built into a token that no action of the wallet made.
  • Settings in other contracts, such as a fee recipient.
  • Value inside other protocols. It moves under their rules.
  • An NFT of another collection inside the wallet, with a wallet of its own.
  • Token admin powers, such as a pause or a block list.
  • Owners that change without a move of the NFT, such as a Safe owned by another NFT's wallet.
  • A send by the owner to a contract that pays on receipt.
  • Other collections with false NFT code that name our market.
  • What the buyer's list does not cover: the value of a token we do not know, a token that cannot be checked, and the small share a buyer allows for an active agent.

The cost for an agent: it approves, uses and resets in each action. It signs nothing as the wallet. NFT sales and signed orders go through its own address. Keep it safe has the details.

Sources

Opened and read on 2026-10-29. Quotes are from these pages.

  • ERC-6551: Security Considerations, "Fraud Prevention" and "Ownership Cycles". Status: Review, not final.
  • The ERC-6551 discussion, post 225: why it is not final ("bait-and-switch scams").
  • Post 206: "The edge case here is approval-based transfers".
  • Post 237: why the early lock was removed.
  • ERC-5646: the state fingerprint, and the change "before accepting an offer".
  • Tokenbound contracts: the lock of AccountV3, and the Zellic audit (finding 3.2: a seller acts before the sale through a nested wallet; fixed).

We found no public report of a buyer who lost value this way. These are known design problems, named by the standard, its author and an audit.

The proposal and the code

  • The proposal (the ERC draft): published later.
  • The open contract kit (MIT), for any collection: published later.